question about switchport port security

[Dr.X]

hi , i have a confusing in a point

now assume i typed

int f0/0

switchport port-security

switchport maximum 10

=======================

by default the switch will learn the mac address and if it learned 11  the port will go into error disabled and this i understood it

but

what is the difference if i typed :

int f0/0

switchport port-security

switchport maximum 10

switchport port-security mac-address sticky

=======================

i also read that mac-address sticky will learn the mac dynamicly

so whats the differnece between the two methods which i typed ???

does that mean that

mac-address sticky

is enabled by default on the switch ??

regards

[NormMuelleman]

Cadet alain:

Pulled directly from Cisco:

When configuring port security violation modes, note the following information:

•protect—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value.

•restrict—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the SecurityViolation counter to increment.

•shutdown—Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.

The only thing restrict does over protect mode is that it causes the SecurityViolation counter to increment. It does not send an SNMP trap. That was covered repeatedly in CCNA-Security as well.

[cadet alain]

Hi,

also pulled from Cisco :http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_58_se/configuration/guide/swtrafc.html#wp1201386

"restrict—When the number of secure MAC addresses  reaches the maximum limit allowed on the port, packets with unknown  source addresses are dropped until you remove a sufficient number of  secure MAC addresses to drop below the maximum value or increase the  number of maximum allowable addresses. In this mode, you are notified  that a security violation has occurred. An SNMP trap is sent, a syslog  message is logged, and the violation counter increments. "

The question is now which Cisco source is right ? I don't have a switch near me to test but i'll do it this week.

Regards.

Alain

Don't forget to rate helpful posts.